🤚 The Open-Palm Incident Report

Security researchers at Palo Alto Networks’ Unit 42 have documented a campaign in which threat actors are calling employees on Microsoft Teams, pretending to be IT support, and then walking them through installing a remote access trojan called EtherRAT. The malware’s signature innovation: it uses Ethereum smart contracts to locate its command-and-control servers, because apparently even cybercriminals have a blockchain strategy now.

The attack chain is a masterclass in social engineering layered on top of technical sophistication:

• Step 1: Victim receives a phishing email with a PDF labeled “Employee Survey” — the most trusted and least interesting document format in corporate history
• Step 2: After the victim opens the PDF, attackers initiate a Microsoft Teams voice call from an external tenant, displaying as “System Administrator”
• Step 3: Through screen-sharing, the attacker convinces the victim to install a remote access tool — either HopToDesk or AnyDesk
• Step 4: An MSI installer (v7.msi) deploys a Node.js runtime that downloads and executes the EtherRAT payload

Teams helpfully displays an “External unfamiliar” label on the call, which is the digital equivalent of a stranger’s van having “FREE CANDY” painted on the side. Employees are clicking “Accept” anyway.

👐 The Two-Handed Technical Breakdown

EtherRAT itself is not your grandmother’s trojan — assuming your grandmother’s trojan used HTTP callbacks and a hardcoded IP address like a civilized piece of malware. This one queries Ethereum smart contracts on the blockchain to retrieve its C2 server addresses. The implications are significant and, frankly, annoying for defenders.

Traditional command-and-control infrastructure can be taken down. You find the server, you call the hosting provider, you file an abuse report, you wait three weeks, the server goes offline. With blockchain-based C2, the addresses are stored on a decentralized, immutable ledger that no single authority can modify or delete. The attacker can update the smart contract to point to a new server, and every infected machine will follow the redirect like obedient little nodes. It is infrastructure-as-a-service, except the service is crime and the infrastructure is permanent.

Once installed, EtherRAT can execute commands, manipulate files, steal data, and maintain persistence — the four food groups of any self-respecting remote access trojan. The choice of Node.js as the runtime is either a pragmatic decision about cross-platform compatibility or a commentary on the state of modern software development. Possibly both.

🌿 The Gentle Awakening

There is something deeply poetic about the attack vector here. Microsoft Teams — the application that was force-installed on every corporate laptop during the pandemic, that replaced casual hallway conversations with scheduled video calls, that turned “quick question” into a calendar invite — is now being used to deliver malware via the same voice calls that employees have been trained to answer without question.

The social engineering works because it exploits the most fundamental vulnerability in corporate IT: employees are conditioned to do whatever IT support tells them. Years of “please install this update,” “please restart your machine,” and “please click this link to reset your password” have created a workforce that will install literally anything if the person asking sounds sufficiently bored and authoritative. The attackers did not hack Microsoft Teams. They hacked corporate culture.

And the “Employee Survey” PDF that starts the chain? No one likes filling out employee surveys. But everyone opens them, because the alternative is a follow-up email from HR, and HR’s follow-up emails are scarier than malware.

👑 The Gold-Leaf Reckoning

Microsoft has responded by deploying warnings that identify external callers, brand impersonation alerts, and new bot-filtering policies for Teams meetings. These are reasonable measures. They are also the digital equivalent of putting a “BEWARE OF DOG” sign on a fence with no dog — useful for deterring the cautious, irrelevant to the determined.

The real lesson of EtherRAT is that the attack surface of the modern enterprise is no longer the firewall, the endpoint, or even the email gateway. It is the human being who answers the phone. And that human being has been so thoroughly trained to comply with IT requests that distinguishing a legitimate support call from a threat actor requires a level of skepticism that most corporate cultures actively discourage.

The blockchain C2 angle adds a layer of permanence that should concern every SOC analyst reading this. When your malware’s infrastructure is stored on the same technology that people use to sell $400,000 JPEGs of cartoon apes, you know the threat landscape has entered a new and profoundly stupid era of sophistication.

“The attacker called on Teams, spoke in a calm IT voice, asked the employee to install one small tool, and then deployed a trojan with blockchain-grade infrastructure. The employee’s only mistake was answering the phone, which is also what their performance review requires them to do.” — The Slap of Wisdom Incident Response Team, now screening all calls and telling HR the survey will be completed ‘by end of quarter’